Enforce roles on admin endpoints and return real status codes

- users, SMTP and batch-lock endpoints are owner/admin only
- engines answer 400/403/404/409/500 instead of 200 with an error body;
  database errors no longer leak to the client

app/ics/api/engine_report/warehouse_overview.php

@@ -8,6 +8,7 @@
 
     if (!$warehouse_id) {
         $answer['success'] = 0;
+        http_response_code(400);
         $answer['message'] = 'Warehouse is required';
         exit(json_encode($answer));
     }